(WIP) Revamp container, Arch --> Cachy & mass-tidy up

[raven0034]

Broad Overview

• Initial migration from base Arch to CachyOS, an optimised Arch variant, suitable for the project's use case
• Mass tidy-up of redundant and/or conflicting configurations, states & similar in the pre-configured home directory
• Add local registry to facilitate building container image locally, which the .xsession will then "pull" from, rather than spamming GHCR with redundant multi-gigabyte downloads across 50+ PCs every week
• Currently being tested in the wild as of the last few FNGs (testing in prod my beloved. In all seriousness, I don't have an array of paid-for titles in my game library compared to the combined collection of FNG-goers, so this is unironically the best way to more thoroughly test unfortunately)

Specifics

OS

• The target environment, CS0.03, has PCs using i5-12500s. They do not have AVX-512 support, hence opting for the x86_64-v3 variant of CachyOS rather than x86_64-v4 (my understanding is Alder Lake is not rated for AVX-512 since E-cores do not support the instruction set). However, we can still optimise for the v3 instruction set
• Like base Arch, CachyOS operates on a rolling release basis, and includes "bleeding edge" optimised packages that deliver better performance

Home directory restructuring

The vast majority of the current pre-supplied home directory is redundant or conflicting. The repository should ideally contain the minimal configuration needed to make changes from the defaults, rather than those changes dumped in with the changes

General note on KDE configs

• KDE configs outside of .config/kdedefaults will be generally be ignored and/or regenerated given that the container is ephemeral and will always be used in the scope of a first-time login
• Some configs, such as kded5rc, are no longer useful in the target KDE Plasma 6 environment

Removals

.gtkrc-2.0

• Redundant, kde-gtk-config exists

.nvidia-settings-rc

• Gets ignored

.config/autostart/ [Directory removed]

• pulseaudio.desktop - Distrobox passes off host's pulseaudio already, starting our own only causes failures
• fng-admin-client.desktop - fng-admin is currently broken (intended to be fixed/rewritten at some point), no point autostarting a redundant client

.config/dconf/ [Directory removed]

• user - Shouldn't be tracking a binary state in git, redundant to keep due to GTK apps pulling from kde-gtk-config anyway

.config/kde.org/ [Directory removed]

• UserFeedback.org.kde.plasmashell.conf - Redundant analytics stuff

.config/gtk-3.0/ [Directory removed]

• * - Again kde-gtk-config is used, these will be dynamically generated anyway

.config/gtk-4.0/ [Directory removed]

• * - See above

.config/kdedefaults/

• kwinrc - Water is wet. Plasma uses Breeze as its default anyway
• plasmarc - Not needed for Plasma 6, it'll use default anyway then reference kdeglobals to pick up BreezeDark

Base .config/

• Trolltech.conf - Auto-generated based on kdeglobals
• gtkrc - Deprecated config
• gtkrc-2.0 - Deprecated config
• kactivitymanagerd-statsrc - Used for favourites on Start Menu. Not strictly needed, but may re-add to .config/kdedefaults
• kconf_updaterc - Already using Plasma 6, no need to track migrations from Plasma 5
• kded5rc - KDE Daemon 5 config, gets ignored. Host handles mounting anyway
• konsolerc - Static Konsole config that gets regenerated on first launch anyway. Also no need to prevent toolbar moving
• ksmserverrc - Ephemeral container. There's no last session to remember anyway. Plasma 6 uses emptySession by default anyway, should we migrate to a more reusable container
• ktimezonedrc - Incorrectly set to UTC rather than Europe/London. Seems to be ignored regardless (passing env TZ=Europe/London when creating the container works)
• kwinrc - Virtual Desktop and Window Tiling configs that are bound to a specific UUIDs which aren't referenced anywhere else, hence redunant
• plasma-localerc - Default is C.UTF-8 regardless. Preferable locale is en_GB.UTF-8, now currently set through LANG and HOST_LOCALE at point of container creation
• plasmarc - Redundant, wallpaper only gets set if configured correctly in its containment via plasma-org.kde.plasma.desktop-appletsrc
• powermanagementprofilesrc - Already on Plasma 6. We don't use powerdevilrc anyway, power management is handled by the host
• user-dirs.dirs - Ineffective since currently we don't actually have a user created - see Todos
• user-dirs.locale - Also ineffective, and incorrectly set to C rather than en_GB

.local/state/ [.local directory removed]

• konsolestaterc - Redundant storage of Konsole positioning from a Xephyr session
• plasmashellstaterc - Redundant storage of Konsole search from a Xephyr session
• systemsettingsstaterc - Redundant storage of System Settings positioning, and opening of wallpaper.png, from a Xephyr session

Moved/merged from .config/ to .config/kdedefaults

• baloofilerc
• kactivitymanagerdrc
• kdeglobals [duplicate removed]
• kglobalshortcutsrc
• kscreenlockerrc
• ksplashrc [duplicate removed]

Each moved so they actually get treated as immutable config templates, rather than just being immediately overwritten.

Other home directory changes

.config/kdedefaults/kactivitymanagerdrc

• Changed default ActivityID (needed to bind various theme and config correctly) to aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa. This is painful so like, the configs can scream too yano?

.config/kdedefaults/kdeglobals

• Added [General]/ColorSchemeHash and [KDE]/LookAndFeelPackage previously in kdeglobals but not present in kdefaults/kdeglobals
• Mitigate soft-lock issues with attempting to lock screen and switching user with the following from KDE Kiosk's Action Restrictions:

[KDE Action Restrictions][$i]
action/lock_screen=false
action/switch_user=false

.config/kdedefaults/kglobalshortcutsrc

• Updated default ActivityID to aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
• Nothing much of note past this, mainly just regenerated

.config/plasma-org.kde.plasma.desktop-appletsrc

• Updated default ActivityID to aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
• Containment IDs are now relatively sane (doesn't really matter but it bugs me)
• Fixed wallpaper config. Acts as one source of truth for wallpaper now
• Again, beyond this, basically just regenerated

.config/plasmashellrc

• Removed panel floating for UX consistency

pacman.conf

• See Dockerfile changes

Build Changes

Dockerfile

• Changed docker.io/library/archlinux:latest to docker.io/cachyos/cachyos-v3 (note v3 refers to x86_64-v3, rather than an overall CachyOS versioning)
• Migrated pacman.conf changes to home/pacman.conf to copy in, cleaner than trying to sed the current changes currently
• Setup CachyOS keyring for pacman, install cachyos-keyring and cachyos-mirrorlist
• Removed vulkan-nouveau and lib32-vulkan-nouveau (ships with vulkan-nouveau-git and lib32-vulkan-nouveau-git anyway)
• Removed pkg-config (redundant)
• Added yay - probably will remove since now redundant
• Removed jre17-openjdk (redundant, also kept jre21-openjdk)
• Added proton-cachyos - Built on top of Proton's bleeding-edge branch, applies various modifications that see more success running various games
• Removed rye (project was abandoned in favour of uv anyway) (redundant)
• Changed cargo to rust for ease of removal after compiling dcslauncher and installing dcspkg - no point keeping in image
• Use --depth=1 when cloning dcslauncher
• Removed redundant creation of user build
• sudo access changed from being controlled under /etc/sudoers to global directive under /etc/sudoers.d/acc (required to have mode 0440 for security reasons)
• Removed redundant WORKDIR change to /

New file: home/pacman.conf

• Add NoExtract directive for usr/share/man/*, usr/share/doc/*, usr/share/gtk-doc/*, usr/share/help/* - no point extracting redundant stuff we're going to delete anyway
• For posterity: CachyOS enables the multilib repository by default, so the previous sed of this into pacman.conf is now redundant
• See .xsession changes for explanation of Distrobox cursedness

New file: local-registry.sh

• Allows spinning up a local http registry on localhost:5000 to be push and pull the container image to/from $HOME/.local/share/container-registry
• Logging in has significant overhead when pulling the image from GHCR each time: as of the preceding commit's tree, login currently takes 3-5 minutes on the target machines. The local registry change has assisted in the reduction of this to 20-40 seconds, a huge improvement

New file: host/99-local.conf

• Registry config so Podman knows of the container's existence
• insecure = true needed since it's an http registry
• Currently assumes presence in $HOME/.config/containers/registries.conf.d (don't use as $HOME/.config/containers/registries.conf else Podman will ignore /etc/containers/registries.conf)

builddev.sh

• Now runs local-registry
• Builds to tag localhost:5000/fng:dev rather than fng:dev
• Pushes image to local-registry and stops local-registry

host/.xsession

• Now runs local-registry and pulls localhost:5000/fng:dev

Speaking of .xsession...

.xsession changes

• Added a bit of a low-effort shitpost with mpv to display some login entertainment (hence the loop checking whether the container has finished starting up)
• Removed --security-opt apparmor=unconfined since Rocky doesn't have AppArmor regardless (--security-opt label=disable also needs removing since --privileged makes it redundant, and DCS doesn't (currently) have SELinux enabled)
• Added TZ, LANG, HOST_LOCALE to fix timezone and locale issues detailed above
• Bind system bus
• Added cursed pre and post-init hooks to mitigate stupidity in setup_pacman in distrobox-init, which forcibly updates packages, installs a hardcoded list of packages we didn't ask for (causing nouveau conflicts on Cachy), overrides pacman.conf changes to NoExtract and NoProgressBar, etc... I hate this workaround, but by linking pacman to /usr/bin/true temporarily, we don't have to play a game of whack-a-mole, and we keep Distrobox happy. I believe this was one of the primary causes to things with the container seemingly breaking out of the blue week-to-week, despite having not actually rebuilt the image. Also a contributor to slow login times
• Attempt to mitigate volume unlinking issues with podman unshare buildah unmount --all (needs further testing)
• Removed redundant -it 0 on podman stop

home/startsession.sh changes

• Removed redundant deletion of flathub remote
• Removed installation of org.vinegarhq.Sober (already available for installation via dcslauncher)
• Added temporary mime mitigation (needs further testing, preferable to remove)
• Set GLVND via __EGL_VENDOR_LIBRARY_FILENAMES to mitigate container occasionally falling back to software rendering/using the iGPU
• Experiment with __GL_THREADED_OPTIMIZATIONS=1 to get the OpenGL driver to split CPU work across threads
• Experiment with __GL_SHADER_DISK_CACHE_SKIP_CLEANUP=1 - in theory, no point clearing shader cache in an ephemeral container, preferable to avoid rebuilding shaders where possible (i.e. in the case of re-launching a game)
• Added (commented out) assignment of ForceFullCompositionPipeline=On in connection with Nvidia force composition pipeline #5. Breaks fullscreen apps if window unredirection is enabled in kwin
• Remove usage of dbus-run-session when running startplasma-x11, cleaner to use just use the host's session bus

TODOs (non-exhaustive)

More home directory clean-up

• In kglobalshortcutsrc, its regeneration led to kded5, powerdevil etc config creeping in. Needs removing or mapping out to none,none (Removed)
• plasma-org.kde.plasma.desktop-appletsrc - Redundant applet blocks for stuff like battery, brightness etc should be removed (Done)
• [ScreenConnectors] bit in plasmashellrc is redundant (Removed)
• In kdeglobals, [KFileDialog Settings] is redundant (Removed, also cleaned up other bloat)
• kcminputrc is redundant - Plasma will use breeze_cursors out of the box anyway (Removed)
• ksplashrc - not technically necessary (Removed)
• package is redundant (Removed)
• xsettingsd.conf is redundant (Removed)
• .bashrc is empty (Removed)

Indexing

• Depending on other revamps, review baloofilerc to potentially add additional indexing exclusions (e.g. indexing the host is a Bad:tm: idea)

Registry

- 99-local.conf can likely just be replaced by using --tls-verify=false with podman push/pull (done)

QoL

• Redesign wallpaper - e.g. references to "enabling Proton" in Steam are redundant. Pointer to help guides (to be written) on compatibility tools etc, would be potentially helpful
• Add new shortcuts to the desktop e.g. for Lutris
• Properly create fng user so e.g. xdg-user-dirs-update can actually do its job
• Look into cachyos-gaming-meta and cachyos-gaming-applications (the latter would additionally install Gamescope, GOverlay, MangoHud, Heroic and Faugus, which makes me hesitant due to image bloat)
• Host machines don't support NTSYNC out of the box since the host kernel is <6.x, likely sensible to disable this
• Investigate other Proton/Cachy provided flags for performance improvements
• See if ForceFullCompositionPipeline=On with kwin window unredirection disabled is actually worth it, given the target PCs were upgraded since this project last saw significant development
• Investigate proton-cachyos-slr to help with some ant-cheat issues
• Probably yeet yay
• Look more into better clean-up than prior reliance on podman system reset -f (slow), and additionally ensure /var/tmp is properly cleaned after we use it, partly since DCS' automated tooling for this seems unreliable based on observation, and because we shouldn't hog the disk space away from others!
• Potentially add some brief checks and warning wrt /proc/sys/user/max_user_namespaces (disabled user namespaces prevents the container running on the target host, overly limited namespaces may cause issues with various applications) and /proc/sys/kernel/yama/ptrace_scope (ptrace_scope < 2 needed for e.g. Sober to function, multiple games with some form of anticheat generally seem to have issues directly connected to this)
• Collate updated set of udev rules to send to DCS Tech (also check why e.g. Dolphin Emu picking up input from controllers otherwise seemingly fine, is borked)
• Sort logging out properly

Connected UWCS Projects

• Review @JasonCubed132 's dcslauncher PR, and integrate CI/CD pipeline rather than recompiling locally as part of the container build process
• CI/CD for dcspkg then cargo dependence can be removed
• Properly fix/rewrite fng-admin (lol)

Documentation

• Yes

Remove Distrobox dependence, clean-up .xsession and Dockerfile

• Longer term project (and likely separate PR), but god this thing is a bloody headache (see above). We don't need to depend on it and (with some pain), can do the useful bits ourselves. Main pain is nvidia shenanigans (also pls DCS, update the Nvidia Container Toolkit I beg)
• Will help address some security concerns detailed to the relevant people offline, and can remove the stupid pacman hack
• "I think distrobox is lowkey a scam" (Anonymous, 2026)

Some other stuff I'll probably remember later

• lol

To mess around with yourself

• In $HOME/.xsession

cd ~/fng/
./host/.xsession

• Run buildev.sh
• Login with Userscript selected, or get Xephyr and run rundev.sh to test in an X window

---

Hopefully that's everything for now I spent way too long writing this, will make additional progress on this when I have time

Some early review comments:

• "Holy fucking shit" (Anonymous, 2026)
• "Oh my fucking god" (Anonymous, 2026)
• "The fuck how" (Anonymous, 2026)
• ":o" (Anonymous, 2026)

:3

[raven0034]

I was originally thinking of potentially ditching the GHA workflow however I'm thinking now of adapting it to allow people to still pull a pre-built image if they want & are cool with the time penalty for logging in. Plus perhaps add flag to build script if people want to build w/o the local reg (ie just dump in /var/tmp as previous). Not needed for the society's usage directly, but easier for people to use on their own accounts (particular when dealing with quota constraints)